Systems and methods for controlling email access

ABSTRACT

Embodiments of the disclosure relate to proxying at least one email resource from at least one email service to at least one client device, determining whether the email resources are accessible to the client devices via at least one unauthorized application on the client devices, and modifying the email resources to be inaccessible via the unauthorized applications on the client devices in response to a determination that the email resources are accessible via the unauthorized applications on the client devices.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. application Ser. No.14/687,394, filed Apr. 15, 2015, which is a continuation of U.S.application Ser. No. 13/750,887, filed Jan. 25, 2013, which has issuedas U.S. Pat. No. 9,021,037, which is a continuation-in-part of U.S.application Ser. No. 13/706,499, filed on Dec. 6, 2012, which has issuedas U.S. Pat. No. 8,978,110, the contents of both of which are herebyexpressly incorporated by reference in their entireties.

FIELD OF THE INVENTION

Embodiments of the disclosure relate generally to data security, andmore particularly, to systems and methods for controlling email access.

BACKGROUND

Controlling email access is critical to ensure that email resources mayonly be accessed by authorized parties in authorized manners. To date,enterprises have utilized access credentials to control which, if any,parties may access email resources. This method may ensure that onlyauthorized parties may access email resources. However, this methodfails to control how those email resources may be accessed by the properrecipients. This method further fails to modify the email resources tocomply with enterprise security standards. As enterprises seek toprotect sensitive information, systems and methods for controlling emailaccess are necessary to ensure that email resources may only be accessedby authorized parties in authorized manners.

BRIEF SUMMARY

Some or all of the above needs and/or problems may be addressed bycertain embodiments of the disclosure. Certain embodiments may includesystems and methods for controlling access to networks. According to oneembodiment of the disclosure, there is disclosed a system. The systemcan include at least one client device. The system can also include atleast one email service. The system can further include at least onememory that stores computer-executable instructions. The system can yetfurther include a processor configured to access the at least onememory. The processor is configured to execute the computer-executableinstructions to perform a method including the steps of proxying emailresources from email services to client devices, determining whether theemail resources are accessible via unauthorized applications on theclient devices, and configuring the email resources to be inaccessiblevia unauthorized applications on the client devices in response to adetermination that the email resources are accessible via unauthorizedapplications on the client devices.

According to another embodiment of the disclosure, there is disclosed amethod. The method can include identifying email resources on clientdevices, determining whether the email resources are accessible viaunauthorized applications on the client devices, and configuring theemail resources to be inaccessible via unauthorized applications on theclient devices in response to a determination that the email resourcesare accessible via unauthorized applications on the client devices.

Further, according to another embodiment of the disclosure, there isdisclosed a non-transitory computer-readable medium embodying a programexecutable in a computing device, the program comprising code that, whenexecuted by a computing device, causes the computing device to perform amethod comprising the steps of identifying email resources, determiningwhether the email resources are accessible via unauthorized applicationson client devices, and configuring the email resources to beinaccessible via unauthorized applications on client devices in responseto a determination that the email resources are accessible viaunauthorized applications on client devices.

Other embodiments, systems, methods, apparatus aspects, and features ofthe disclosure will become apparent to those skilled in the art from thefollowing detailed description, the accompanying drawings, and theappended claims.

BRIEF DESCRIPTION OF THE DRAWINGS

The detailed description is set forth with reference to the accompanyingdrawings, which are not necessarily drawn to scale. The use of the samereference numbers in different figures indicates similar or identicalitems.

FIG. 1 illustrates a block diagram of a networked environment accordingto certain embodiments of the disclosure.

FIG. 2 illustrates a flow diagram of exemplary functionality performedby an access control service executed by an access control server in thenetworked environment of FIG. 1 according to certain embodiments of thepresent disclosure.

FIG. 3 illustrates a flow diagram of exemplary functionality performedby a client side application executed by a client device in thenetworked environment of FIG. 1 according to certain embodiments of thepresent disclosure.

FIGS. 4-5 are exemplary user interfaces rendered by an access controlservice executed by an access control server in the networkedenvironment of FIG. 1 according to certain embodiments of the presentdisclosure.

FIGS. 6-11 are exemplary user interfaces rendered by a client sideapplication executed by a client device in the networked environment ofFIG. 1 according to certain embodiments of the present disclosure.

FIG. 12 illustrates a block diagram of a networked environment accordingto certain embodiments of the disclosure.

FIG. 13 illustrates a flow diagram of exemplary functionality performedby an access control service executed by an access control server in thenetworked environment of FIG. 12 according to certain embodiments of thepresent disclosure.

FIG. 14 illustrates a block diagram of a networked environment accordingto certain embodiments of the disclosure.

FIG. 15 illustrates a flow diagram of exemplary functionality performedby an access control service executed by an access control server in thenetworked environment of FIG. 14 according to certain embodiments of thepresent disclosure.

FIG. 16 illustrates a flow diagram of exemplary functionality performedby a client side application executed by a client device in thenetworked environment of FIGS. 12 and 14 according to certainembodiments of the present disclosure.

FIG. 17 illustrates schematic block diagrams of an access control serverand a client device employed in the network environments of FIGS. 1, 12and 14 according to certain embodiments of the disclosure.

DETAILED DESCRIPTION

Illustrative embodiments of the disclosure will now be described morefully hereinafter with reference to the accompanying drawings, in whichsome, but not all embodiments of the disclosure are shown. Thedisclosure may be embodied in many different forms and should not beconstrued as limited to the embodiments set forth herein; rather, theseembodiments are provided so that this disclosure will satisfy applicablelegal requirements. As noted above, like numbers refer to like elementsthroughout.

Illustrative embodiments of the disclosure are directed to, among otherthings, controlling access to email. As an overview, access to email maybe controlled by limiting access of proper recipients to specific emailresources and by limiting the manner in which the proper recipientsaccess the specific email resources. In certain embodiments, the emailresources may be modified to satisfy enterprise security standardsand/or access restrictions.

The technical effects of certain embodiments of the disclosure mayinclude preventing unauthorized access to email resources andeliminating costs associated with sensitive information loss. Moreover,the technical effects of certain embodiments of the invention mayinclude modifying email resources to satisfy access restrictions.

FIG. 1 depicts certain illustrative components for a networkedenvironment 100 according to various embodiments. In certainembodiments, the networked environment 100 may include a network 110, aclient device 120, and an access control server 150. In someembodiments, the network 110 may be or include, for example, any type ofwireless network such as a wireless local area network (WLAN), awireless wide area network (WWAN), and/or the like. Additionally, thenetwork 110 may be or include the Internet, intranets, extranets,microwave networks, satellite communications, cellular systems, PCS,infrared communications, global area networks, and/or any combination oftwo or more such networks. In one embodiment, the network 110facilitates access to email resources 165 for at least one client device120, where access to the email resources 165 is controlled by an accesscontrol server 150.

The client device 120 may comprise, for example, a cellular telephone, asmartphone and/or personal digital assistant, a tablet computer and/orweb pad, a laptop computer, a desktop computer, a set-top box, a musicplayer, a game console, and/or another device with like capability. Forpurposes of convenience, the client device 120 is referred to herein inthe singular. Even though the client device 120 is referred to in thesingular, it is understood that at least one client device 120 may beemployed in the arrangements as descried herein.

The client device 120 may include a wired network connectivity component(not shown in FIG. 1), for example, an Ethernet network adapter, amodem, and/or the like. The client device 120 may further include awireless network connectivity interface (not shown in FIG. 1), forexample, a PCI (Peripheral Component Interconnect) card, USB (UniversalSerial Bus) interface, PCMCIA (Personal Computer Memory CardInternational Association) card, SDIO (Secure Digital Input-Output)card, NewCard, Cardbus, a modem, a wireless radio transceiver, and/orthe like. The client device 120 may be operable to communicate via wiredconnection with the access control server 150 with the aid of the wirednetwork connectivity component. The client device 120 may be furtheroperable to communicate wirelessly with the access control server 150with the aid of the wireless network connectivity component.

The client device 120 may comprise a memory for storing data andapplications, a processor for executing applications stored in memory, adisplay 136 upon which the processor may execute at least one userinterface 137, and a local interface such as a bus, as will be describedwith respect to FIG. 12. The memory of the client device 120 maycomprise a data store 122. The data store 122 of the client device 120may include a device profile 123. In one embodiment, the device profile123 may represent hardware, software, and security attributes thatdescribe the state of the client device 120. For instance, the deviceprofile 123 may represent hardware specifications of the client device120, version and configuration information of various software programsand hardware components installed on the client device 120, transportprotocols enabled on the client device 120, version and usageinformation of various other resources stored on the client device 120,and/or any other attributes associated with the state of the clientdevice 120. In another embodiment, the device profile 123 may furtherinclude characteristics describing the state of the client device 120,including indications of the location of the client device 120, thecurrent time associated with the client device 120, the client device's120 detection of at least one network beacon associated with at leastone network 110, and the signal strength of the network beacons receivedby the client device 120. In yet another embodiment, the device profile123 may include data indicating a date of a last virus scan of theclient device 120, a date of a last access and/or service by anInformation Technology (IT) representative, a date of a last access byan access control service 174, and/or any other data indicating a dateof last maintenance of the client device 120.

Additionally, the data store 122 of the client device 120 may include atleast one user identifier 132. The user identifiers 132 may uniquelyidentify the user of the client device 120. In one embodiment, the useridentifiers 132 may include a username, a password, and/or biometricdata related to facial recognition, retina recognition, fingerprintrecognition, and the like. Similarly, the data store 122 of the clientdevice 120 may include at least one device identifier 135. The deviceidentifiers 132 may uniquely identify the client device 120. In oneembodiment, the device identifiers 135 may be a unique hardwareidentifier such as a GUID (Globally Unique Identifier), UUID(Universally Unique Identifier), UDID (Unique Device Identifier), serialnumber, IMEI (Internationally Mobile Equipment Identity), Wi-Fi MAC(Media Access Control) address, Bluetooth MAC address, a CPU ID, and/orthe like, or any combination of two or more such hardware identifiers.In another embodiment, the device identifier 135 may be a uniquesoftware identifier such a token or certificate, based at least in parton the aforementioned unique hardware identifiers.

The client device 120 may be configured to execute various applications.For example, the client device 120 may be configured to executeapplications such as secure container applications, web browsingapplications, email applications, instant messaging applications, wordprocessing applications and/or other applications capable of receivingand/or rendering resources 165 on a display 136 associated with theclient device 120. Any application capable of receiving and/or renderingresources 165 on a display 136 of the client device 120 is generallyreferred to herein as a “client side application” 126. The client sideapplication 126 may be stored in the memory of the client device 120. Inone embodiment, the client side application 126 may be a securecontainer application that may be authorized to receive and renderresources 165 in accordance with at least one resource rule 171, asdescribed herein. The client side application 126 may include acryptographic key to decrypt email resources 165 ted with acryptographic key in order to prevent unauthorized access to the emailresources 165. For instance, the client side application 126 may have acryptographic key that may be capable of decrypting email resources 165transmitted in an encrypted format to the client device 120 by an accesscontrol service 174 executed by an access control server 150.

The client side application 126 may be executed to transmit at least onerequest 177 to access at least one email resource 165. In certainembodiments, the client side application 126 may transmit requests 177to an access control service 174. In some embodiments, the requests 177may include a listing of specific email resources 165 the client device120 seeks to access. In other embodiments, the requests 177 may includean indication that the client device 120 seeks access to email resources165 associated with the client device 120, such as email resources 165addressed to the user of the client device 120. In any instance, therequests 177 may include data from the data store 122 of the clientdevice 120 that may assist an access control service 174 in determiningwhether the client device 120 is authorized to access the emailresources 165. In one embodiment, the request 177 may include the deviceprofile 123 associated with the client device 120. In anotherembodiment, the request 177 may include user identifiers 132 associatedwith the client device 120. In yet another embodiment, the request 177may include device identifiers 135 associated with the client device120.

The client side application 126 may be further executed to receive anindication that the client device 120 is authorized to access the emailresources 165. In certain embodiments, the client side application 126may receive an authorization indication from an access control service174 executed by an access control server 150. In some embodiments, theauthorization indication may specify which, if any, email resources 165that the client device 120 is authorized to access and may specify themanner in which the client device 120 may access such email resources165. In one embodiment, the authorization indication may specify thatthe client device 120 is authorized to access the email resources 165while the client device 120 is located within at least one authorizedlocation. In another embodiment, the authorization indication mayspecify that the client device 120 is authorized to access the emailresources 165 while the current time associated with the client device120 is within at least one authorized window. In yet another embodiment,the authorization indication may specify that the client device 120 isauthorized to access the email resources 165 while the client device 120is communicatively connected to at least one network 110 and/or at leastone network beacon associated with the networks 110, as described inapplication Ser. No. 13/656,046 entitled “SYSTEMS AND METHODS FORCONTROLLING NETWORK ACCESS,” which is incorporated herein by referencein the entirety.

The client side application 126 may be further executed to receive atleast one email resource 165. In certain embodiments, the client sideapplication 126 may receive email resources 165 from an access controlservice 174 executed by an access control server 150. In someembodiments, the client side application 126 may receive email resources165 from an enterprise email service, such as Microsoft Exchange, LotusNotes, Novell Groupwise, Zimbra, or the like. In other embodiments, theclient side application 126 may receive email resources 165 from adistribution service executed by a distribution server, as described inapplication Ser. Nos. 13/396,356 and 13/623,627 both entitled“CONTROLLING DISTRIBUTION OF RESOURCES ON A NETWORK,” which areincorporated herein by reference in their entirety.

In any instance, the email resources 165 may include various types ofelectronic data, such as email messages and email attachments. Incertain embodiments, the email messages may include text and/orformatting in email headers, email sender fields, email recipientfields, email subject fields, email bodies, email signatures, and/oremail footers. Additionally, the email attachments may includesettings-type attachments, applications-type attachments, andcontent-type attachments. In one embodiment, settings-type attachmentsmay include hardware settings, software settings, and/or the like thatconfigure the functionality provided by the client device 120. Inanother embodiment, application-type attachments may include bookapplications, business applications, catalogue applications, educationapplications, entertainment applications, finance applications, food anddrink applications, games applications, health and fitness applications,lifestyle applications, medical applications, music applications,navigation applications, news applications, newsstand applications,photo and video applications, productivity applications, referenceapplications, social networking applications, sports applications,travel applications, utility applications, weather applications, and/orthe like. In yet another embodiment, content-type attachments mayinclude application content, video content, image content, audiocontent, text content, word processor content, presentation content,spreadsheet content, database content, compressed folder content, diskimage content, encoded content, backup content, web content, page layoutcontent, plug-in content, font content, system content, developercontent, data content and/or the like.

The client side application 126 may be similarly executed to receive atleast one resource rule 171 associated with the email resources 165. Incertain embodiments, the resource rules 171 may regulate user of and/oraccess to the email resources 165. In some embodiments, the resourcerules 171 may include format rules, content rules, attachment rules,and/or access rules. In one embodiment, the format-type resource rules171 may specify at least one of required, permitted, and/or prohibitedformats of the email resources 165. For example, a format-type resourcerule 171 may specify that all email resources 165 must be encoded withAES-256 bit encryption. In another embodiment, the content-type resourcerules 171 may specify at least one of required, permitted, and/orprohibited content of the email resources 165. For instance, acontent-type resource rule 171 may specify that any email resources 165containing the text “confidential” must be transmitted utilizing asecure transmission protocol, such as the HTTPS/SSL transmissionprotocol. In yet another embodiment, the attachment-type resource rules171 may specify at least one of required, permitted, and/or prohibitedattachments to the email resources 165. For example, an attachment-typeresource rule 171 may specify that attachments to the email resources165 must be stripped from the email resources 165. In yet a furtherembodiment, the access-type resource rules 171 may specify at least oneof required, permitted, and/or prohibited access to the email resources165. For instance, an access-type resource rule 171 may specify that theemail resources 165 must be configured to be exclusively accessible viaa secure container application, such as the client side application 126.Furthermore, the various types of resource rules 171 may be combined toestablish granular access rights. For example, a combination of resourcerules 171 may specify required file formats, encryption protocols, bodyand/or attachment components, and authorized applications associatedwith the email resources 165.

In some embodiments, the resource rules 171 may be metadata and/or otherindications that describe the email resources 165. In particular, theresources rules 171 may specify categories/sub-categories to which theemail resources 165 belong, that the email resources 165 are consideredfavorites, the ownership of the email resources 165, the managing partyof the email resources 165, that the email resources 165 areconfidential, that the email resources 165 are password protected, thehistorical version of the email resources 165, at least one descriptionof the email resources 165, at least one comment regarding the emailresources 165, the size and format of the email resources 165, thedownload priority associated with the email resources 165, an expirationdate associated with the email resources 165, at least one effectivedate associated with the email resources 165, and/or the like.

In other embodiments, the resource rules 171 associated with the emailresources 165 may change based on the state of the client device 120. Incertain embodiments, the stringency of the resource rules 171 may beincreased, reduced, and/or eliminated based on the state of the clientdevice 120. In one embodiment, the stringency of the resource rules 171may be increased, reduced, and/or eliminated if the client device 120 islocated within the transmission range of certain network beacons and/orcertain networks 110 associated with such network beacons. In anotherembodiment, the stringency of the resource rules 171 may be increased,reduced, and/or eliminated if the client device 120 is located within atleast one location. In yet another embodiment, the stringency of theresource rules 171 may be increased, reduced, and/or eliminated if thecurrent time associated with the client device 120 is within at leastone time window. In yet a further embodiment, the stringency of theresource rules 171 may be increased, reduced, and/or eliminated if theclient device 120 has previously satisfied the resource rules 171.

Additionally, the client side application 126 may be executed todetermine whether the client device 120 is authorized to access theemail resources 165. In certain embodiments, the client side application126 may determine whether the resource rules 171 associated with theemail resources 165 are satisfied by the email resources 165. Forinstance, the client side application 126 may determine that the clientdevice 120 is authorized to access the email resources 165 if the emailresources 165 are configured to be inaccessible via certain unauthorizedapplications and are configured to be accessible via certain authorizedapplications, as may be specified by an administrator associated withthe email resources 165. In some embodiments, the client sideapplication 126 may determine whether the client device is authorizedbased at least in part on at least one of the device profile 123, useridentifiers 132, or device identifiers 135.

The client side application 126 may be further executed to modify theemail resources 165. In certain embodiments, the client side application126 may modify the email resources 165 in response to a determinationthat the email resources 165 do not satisfy the resource rules 171associated with the email resources 165. In particular, the client sideapplication 126 may modify the email resources 165 so that the emailresources 165 satisfy the resource rules 171 associated with the emailresources 165, such as by configuring the email resources 165 to beinaccessible via certain unauthorized applications. In some embodiments,the client side application 126 may modify at least one portion of theemail resources 165. In other embodiments, the client side application126 may modify all portions of and/or the entirety of the emailresources 165.

In any instance, the client side application 126 may modify the emailresources 165 by formatting, encoding, encrypting, configuring, adding,removing, stripping, moving, replacing and/or flagging portions of theemail resources 165. In one embodiment, the client side application 126may modify the email resources 165 by formatting the email resources 165into HyperText Markup Language (HTML), Rich Text, Plain Text, and/orother formats. In another embodiment, the client side application 126may modify the email resources 165 by encoding the email resources 165using Advanced Encryption Standard (AES), Data Encryption Standard(DES), and/or other encryption protocols. In yet another embodiment, theclient side application 126 may modify the email resources 165 byconfiguring the email resources 165 to be exclusively accessible via atleast one secure container application, such as the client sideapplication 126. In yet a further embodiment, the client sideapplication 126 may modify the email resources 165 by adding portions toand/or or removing portions from the email resources 165, for instance,by adding or removing an email signature.

Additionally, in an exemplary embodiment, the client side application126 may modify the email resources 165 by removing portions of the emailresources 165 and configuring the removed portions of the emailresources 165 to be exclusively accessible via a secure containerapplication, such as the client side application 126. For example, theclient side application 126 may remove attachments from the emailresources 165 and may encrypt the removed attachments based at least inpart on at least one cryptographic key accessible to the client sideapplication 126. Additionally, the client side application 126 mayencrypt the email resources 165 as a whole, thereby preventing the emailresources 165 from being accessible via certain unauthorizedapplications on the client device 120 that an administrator hasidentified as problematic and/or insecure, while providing access to theemail resources 165 via certain authorized applications. In anotherembodiment, the client side application 126 may modify the emailresources 165 by performing at least one of decrypting the emailresources 165, re-encrypting the email resources 165, digitally signingemail resources 165, or digitally re-signing email resources 165. In yetanother embodiment, the client side application 126 may modify the emailresources 165 by moving certain portions of the email resources 165,such as by moving a photograph from the body of the email resources 165to the attachments of the email resources 165. In yet a furtherembodiment, the client side application 126 may modify the emailresources 165 by replacing certain portions of the email resources 165,such as replacing misspelled text with the properly spelled text. Ineven yet a further embodiment, the client side application 126 maymodify the email resources 165 by flagging the email resources 165 ashaving been modified, such as by attaching an indication to the emailresources 165 that provides information related to the modification ofthe email resources 165.

The client side application 126 may be yet further executed to access atleast one email resource 165. In certain embodiments, the client sideapplication 126 may access the email resources 165 received from anaccess control service 174 and/or another distribution service. In someembodiments, the client side application 126 may access the emailresources 165 on the client device 120 in accordance with the resourcerules 171. For example, the client side application 126 may determinethat the email resources 165 may not be accessed by the client device120 because the client device 120 is not located within an authorizedlocation specified by the resource rules 171 associated with the emailresources 165.

In any instance, the client side application 126 may access the emailresources 165 on the client device 120 by storing, installing,activating, decrypting, confirming digital signatures, rendering and/orexecuting the email resources 165 on the client device 120. In oneembodiment, the client side application 126 may store the emailresources 165 on the client device 120 by placing the email resources165 in the data store 122 of the client device 120. In anotherembodiment, the client side application 126 may install the emailresources 165 on the client device 120 by placing the email resources165 in the data store 122 of the client device 120 and by disablingand/or removing any files that conflict with the email resources 165. Inyet another embodiment, the client side application 126 may activate theemail resources 165 on the client device 120 by placing the emailresources 165 in the data store 122 of the client device 120, bydisabling and/or removing any files that conflict with the emailresources 165, and by instructing the client device 120 to conform itsoperations to the email resources 165. In yet a further embodiment, theclient side application 126 may decrypt the email resources 165 and/orconfirm the digital signature of the email resources 165 to provide theclient device 120 with access to the email resources 165. Additionally,the client side application 126 may call on other applications and/orservices available to the client device 120, which may be associatedwith the email resources 165.

In yet a further embodiment, the client side application 126 may renderthe email resources 165 on the client device 120 by presenting the emailresources 165 in a user interface 137 executed on the display 136 of theclient device 120. In particular, the client side application 126 mayrender the email resources 165 in a user interface 137 by decompressingcompressed files and presenting the uncompressed files, decryptingencrypted files and presenting the decrypted files, confirming thedigital signature of files and presenting the confirmed files, mountingdisk image files and presenting the mounted image files, runningexecutable files and presenting the executed files, by enabling a datasearch of the email resources 165 and presenting the featured output ina user interface 137, by calling on another application on the clientdevice 120 to respond to data links contained within the email resources165, and/or by transmitting a part or the whole of the email resources165 to another application on the client device 120. The client sideapplication 126 may render a single email resource 165 or a series ofemail resources 165 in a comprehensive manner, such as presenting imagefiles in a slideshow-style presentation, and may further render anenvironment that displays an array of email resources 165 in a singleview, such as a category-based tree or outline format. Additionally, inan exemplary embodiment, the client side application 126 may execute theemail resources 165 by placing the email resources 165 in the data store122 of the client device 120, by disabling and/or removing any filesthat conflict with the email resources 165, and by instructing theclient device 120 to perform the operations of the email resources 165.

In certain embodiments, the client side application 126 may be a securecontainer application that is configured to protect the email resources165 from unauthorized access. In some embodiments, the client sideapplication 126 may be configured to protect email resources 165 thathave been received from an access control service 174. In oneembodiment, the client side application 126 may be executed to enforcethe resource rules 171 and/or other metadata associated with the emailresources 165. For instance, the client side application 126 mayprohibit cutting, copying, pasting, transmitting, emailing, textmessaging, screen capturing, and/or otherwise manipulating the emailresources 165 while the email resources 165 are accessed by the clientside application 126. In another embodiment, the client side application126 may prohibit other applications on the client device 120 and/orother services accessible to the client device 120 from accessing theemail resources 165. In particular, the client side application 126 maymonitor the data stream between the network 110 and the client device120, may block any access attempts by another application and/orservice, may proxy the email resources 165, and may present the proxyiedemail resources 165 in a user interface 137 rendered by the client sideapplication 126.

The access control server 150 may comprise, for example, a servercomputer or any other system providing access control capability.Alternatively, a plurality of access control servers 150 may be employedthat are arranged, for example, in at least one server bank or computerbank or other arrangements. For example, a plurality of access controlservers 150 together may comprise a cloud computing resource, a gridcomputing resource, and/or any other distributed computing arrangement.Such access control servers 150 may be located in a single installationor may be distributed among many different geographic locations. Forpurposes of convenience, the access control server 150 is referred toherein in the singular. Even though the access control server 150 isreferred to in the singular, it is understood that a plurality of accesscontrol servers 150 may be employed in the arrangements as descriedherein.

The access control server 150 may comprise a memory for storing data andapplications and a processor for executing applications stored inmemory, as will be described with respect to FIG. 12. The memory of theaccess control server 150 may comprise a data store 153. The data store153 may be representative of at least one data store. The data store 153may contain certain data that is accessible to the access control server150. In particular, the data store 153 may contain at least one emailresource 165 and at least one resource rule 171 associated with theemail resources 165, as described herein. The data in the data store 153may be associated with the operation of certain applications and/orfunctionalities executed by the access control server 150. The datastore 153 may utilize strong encryption standards to protect the emailresources 165 from unauthorized access. For example, the data store 153may utilize AES (Advanced Encryption Standard) or a similar strongencryption standard commonly utilized for server-side data storage.

The access control server 150 may execute certain applications and/orfunctionalities such the access control service 174, as well as otherapplications, services, processes, systems, engines, or functionalitynot disclosed in detail herein. The access control service 174 may beexecuted to control email access. In particular, the access controlservice 174 may limit access to at least one email resource 165 to atleast one client device 120 that is authorized to access the emailresources 165. The access control service 174 may be further executed tomodify at least one email resource 165 so that the email resources 165satisfy at least one resource rule 171 associated with the emailresources 165. The access control service 174 may yet be furtherexecuted to distribute at least one email resource 165 to at least oneclient device 120 that is authorized to access the email resources 165.

The access control service 174 may be executed to control access to atleast one email resource 165. In certain embodiments, the access controlservice 174 may be executed to determine whether at least one clientdevice 120 is authorized to access the email resources 165. In someembodiments, the client side application 126 may determine whether theresource rules 171 associated with the email resources 165 are satisfiedby the email resources 165. For instance, the access control service 174may determine that a client device 120 is authorized to access the emailresources 165 if the attachments to the email resources 165 have beenstripped from the email resources 165 in accordance with the resourcerules 171, which specify that the email resources 165 may not haveattachments. In other embodiments, the access control service 174 maydetermine whether the client device is authorized based at least in parton at least one of the device profile 123, user identifiers 132, ordevice identifiers 135.

The access control service 174 may be further executed to modify theemail resources 165 to satisfy the resource rules 171 associated withthe email resources 165. In certain embodiments, the access controlservice 174 may modify the email resources 165 in response to adetermination that the email resources 165 do not satisfy the resourcerules 171 associated with the email resources 165. In particular, theaccess control service 174 may modify the email resources 165 so thatthe email resources 165 satisfy the resource rules 171 associated withthe email resources 165. In some embodiments, the access control service174 may modify at least one portion of the email resources 165. In otherembodiments, the access control service 174 may modify all portions ofand/or the entirety of the email resources 165.

In any instance, the access control service 174 may modify the emailresources 165 by formatting, encoding, configuring, adding, removing,stripping, moving, replacing or flagging portions of the emailresources. In one embodiment, the access control service 174 may modifythe email resources 165 by formatting the email resources 165 intoHyperText Markup Language (HTML), Rich Text, Plain Text, and/or otherformats. In another embodiment, the access control service 174 maymodify the email resources 165 by encoding the email resources 165 usingAdvanced Encryption Standard (AES), Data Encryption Standard (DES),and/or other encryption protocols. In yet another embodiment, the accesscontrol service 174 may modify the email resources 165 by configuringthe email resources 165 to be exclusively accessible via at least onesecure container application, such as a client side application 126. Inyet a further embodiment, the access control service 174 may modify theemail resources 165 by adding portions to and/or or removing portionsfrom the email resources 165, for instance, by adding or removing anemail signature.

Additionally, in an exemplary embodiment, the access control service 174may modify the email resources 165 by removing portions from the emailresources 165 and configuring the removed portions of the emailresources 165 to be exclusively accessible via a secure containerapplication, such as the client side application 126. For example, theaccess control service 174 may remove attachments to the email resources165 from the email resources 165, may encode the removed attachmentsbased at least in part on at least one cryptographic key, and may makethe removed attachments and cryptographic keys accessible to the clientside application 126. In another embodiment, the access control service174 may modify the email resources 165 by performing at least one ofdecrypting the email resources 165, re-encrypting the email resources165, cryptographically signing email resources 165, or re-signing emailresources 165. In yet another embodiment, the access control service 174may modify the email resources 165 by moving certain portions the emailresources 165, such as by moving a photograph from the body of the emailresources 165 to the attachments of the email resources 165. In yet afurther embodiment, the access control service 174 may modify the emailresources 165 by replacing certain portions of the email resources 165,such as replacing misspelled text with the properly spelled text. Ineven yet a further embodiment, the access control service 174 may modifythe email resources 165 by flagging the email resources 165 as havingbeen modified, such as attaching an indication to the email resources165 that provides information related to the modification of the emailresources 165.

The access control service 174 may be yet further executed to transmitat least one email resource 165 to at least one client device 120. Incertain embodiments, the access control service 174 may transmit theemail resources 165 to the client devices 120 responsive to adetermination that the client devices 120 are authorized to access theemail resources 165. In some embodiments, the access control service 174may transmit the email resources 165 to the client devices 120responsive to modifying the email resources 165 to satisfy the resourcerules 171 associated with the email resources 165. In one embodiment,the access control service 174 may directly transmit the email resources165 to a client side application 126 executed by the client devices 120.In another embodiment, the distribution service 174 may make the emailresources 165 available for download by the client devices 120 and maytransmit the email resources 165 to the client devices 120 uponreceiving requests 177 to download the email resources 165 from theclient devices 120. In any instance, the access control service 174 mayestablish a communicative connection with the client devices 120 byutilizing a secure transmission protocol, such as HTTPS/SSL, beforetransmitting the email resources 165 to the client devices 120.

FIG. 2 is a flowchart illustrating exemplary functionality performed byan access control service 174 executed by an access control server(FIG. 1) according to certain embodiments. It is understood that theflowchart of FIG. 2 provides merely an example of the many differenttypes of functional arrangements that may be employed to implement theoperation of the access control service 174 as described herein. As analternative, the flowchart of FIG. 2 may be viewed as depicting anexample of steps of a method implemented in the access control server150 according to at least one embodiment.

Beginning with step 203, the access control service 174 may identify atleast one email resource 165. In certain embodiments, the access controlservice 174 may identify at least one email resource 165 associated withat least one client device 120. In one embodiment, the email resources165 may be associated with the client devices 120 if the email resources165 are addressed to the client devices 120 and/or the users of theclient devices 120. For instance, the email resources 165 may beaddressed to the client devices 120 and/or the users of the clientdevices 120 if the identities of the client devices 120 and/or the usersof the client devices 120 are specified within the email headers, emailsender fields, email CC fields, email BCC fields, email recipientfields, email subject fields, email bodies, email signatures, and/oremail footers of the email resources 165. In another embodiment, theemail resources 165 may be associated with the client devices 120 if theemail resources 165 are accessible to the client devices 120, forinstance, via at least one user identifier, at least one deviceidentifier, and/or at least one device profile associated with theclient devices 120. In yet another embodiment, the email resources 165may be associated with the client devices 120 according to a listing ofassociated email resources 165 and client devices 120. In any instance,the email resources 165 may include email messages, email attachments,and/or other electronic data, as described herein.

Next, in step 206, the access control service 174 may identify at leastone resource rule 171. In certain embodiments, the access controlservice 174 may identify at least one resource rule 171 associated withat least one email resource 165. In some embodiments, a given resourcerule 171 may be associated with at least one email resource 165 and,similarly, a given email resource 165 may be associated with at leastone resource rule 171. In one embodiment, the resource rules 171 may beassociated with the email resources 165 if the resource rules 171 areembedded within the email headers, email bodies, email signatures,and/or email footers of the email resources 165. In particular, theemail resources 165 may include embedded metadata and/or otherinstructions that represent at least one resource rule 171. In anotherembodiment, the resource rules 171 may be associated with the emailresources 165 if the resource rules 171 are affixed to the emailresources 165, such as attachments to the email resources 165. In yetanother embodiment, the resource rules 171 may be associated with theemail resources 165 according to a listing of associated email resources165 and resource rules 171. In any instance, the resource rules 171 mayregulate access to the email resources 165 associated with the resourcerules 171 by the client devices 120 associated with the email resources165, as described herein.

Then, in step 209, the access control service 174 may determine whetherthe email resources 165 satisfy the resource rules 171 associated withthe email resources 165. In certain embodiments, the access controlservice 174 may determine that the client devices 120 associated withthe email resources 165 are authorized to access the email resources 165if the email resources 165 satisfy the associated resources rules 171.In any instance, the access control service 174 may determine whetherthe state of the email resources 165 satisfies the requirementsspecified by the associated resource rules 171. In particular, theaccess control service 174 may determine whether the email headers,email sender fields, email CC fields, email BCC fields, email recipientfields, email subject fields, email bodies, email signatures, emailfooters, and/or email attachments of the email resources 165 satisfy theassociated resource rules 171, as described herein.

If the access control service 174 determines that the email resources165 do not satisfy the resource rules 171, then the access controlservice 174 may proceed to step 212 and may modify the email resources165. In certain embodiments, the access control service 174 may modifythe email resources 165 so that the email resources 165 satisfy theresource rules 171 associated with the email resources 165. In someembodiments, the access control service 174 may modify at least oneportion of the email resources 165. In other embodiments, the accesscontrol service 174 may modify all portions of and/or the entirety ofthe email resources 165. In any instance, the access control service 174may modify the email resources 165 by formatting, encoding, configuring,adding, removing, stripping, moving, replacing and/or flagging portionsof the email resources 165, as described herein.

On the contrary, if the access control service 174 determines that theemail resources 165 satisfy the resource rules 171, then the accesscontrol service 174 may proceed to step 215 and may authorize the clientdevices 120 to access the email resources 165. In certain embodiments,the access control service 174 may authorize the client devices 120 toaccess the email resources 165 by transmitting the email resources 165to at least one client side application 126 executed by the clientdevices 120. In some embodiments, the access control service 174 mayauthorize the client devices 120 to access the email resources 165 bynotifying the client devices 120 that the email resources 165 may bedownloaded from the access control service 174 and may further transmitthe email resources 165 to the client devices 120 upon a request 177. Inany instance, the access control service 174 may authorize the clientdevices 120 to access the email resources 165 by providing the clientdevices 120 with a means of accessing the email resources 165. In oneembodiment, the access control service 174 may authorize the clientdevices 120 to access at least one unmodified email resource 165. Inanother embodiment, the access control service 174 may authorize theclient devices 120 to access at least one email resource 165 that hasbeen modified by the access control service 174 so that the emailresources 165 satisfy the resource rules 171 associated with the emailresources 165.

FIG. 3 is a flowchart illustrating exemplary functionality performed bya client side application 126 executed by a client device 120 (FIG. 1)according to certain embodiments. It is understood that the flowchart ofFIG. 3 provides merely an example of the many different types offunctional arrangements that may be employed to implement the operationof the client side application 126 as described herein. As analternative, the flowchart of FIG. 3 may be viewed as depicting anexample of steps of a method implemented in the client device 120according to at least one embodiment.

Beginning with step 303, the client side application 126 may transmit atleast one request 177 to access at least one email resource 165. Incertain embodiments, the client side application 126 may transmitrequests 177 to an access control service 174. In some embodiments, therequests 177 may include a listing of specific email resources 165 thatthe client device 120 seeks to access. In other embodiments, therequests 177 may include an indication that the client device 120 seeksaccess to email resources 165 associated with the client device 120,such as email resources 165 addressed to the user of the client device120. In any instance, the requests 177 may include data from the datastore 122 of the client device 120, such as device profiles 123, useridentifiers 132, and device identifiers 135 associated with the clientdevice 120, as described herein.

Next, in step 306, the client side application 126 may receive at leastone email resource 165. In certain embodiments, the client sideapplication 126 may receive at least one email resource 165 from anaccess control service 174 executed by an access control server 150. Inone embodiment, the client side application 126 may directly receive theemail resources 165 from the access control service 174. In anotherembodiment, the client side application 126 may receive at least oneindication from the access control service 174 that specify that theemail resources 165 are available for download from the access controlservice 174. In such embodiment, the client side application 126 mayrequest to download the email resources 165 from the access controlservice 174 in response to receiving an indication that the emailresources 165 are available for download from the access control service174. In some embodiments, the client side application 126 may receive atleast one email resource 165 from an enterprise email service, such asMicrosoft Exchange or Lotus Notes, or from a distribution serviceexecuted by a distribution server, as described herein.

Then, in step 309, the client side application 126 may identify at leastone resource rule 171. In certain embodiments, the client sideapplication 126 may identify at least one resource rule 171 associatedwith at least one email resource 165. In some embodiments, the resourcerules 171 may be associated with multiple email resources 165 and theemail resources 165 may be associated with multiple resource rules 171,as described herein. In one embodiment, the resource rules 171 may beassociated with the email resources 165 if the resource rules 171 areembedded within the email headers, email bodies, email signatures,and/or email footers of the email resources 165. In particular, theemail resources 165 may include embedded metadata and/or otherinstructions that represent at least one resource rule 171. In anotherembodiment, the resource rules 171 may be associated with the emailresources 165 if the resource rules 171 are affixed to the emailresources 165, such as attachments to the email resources 165. In yetanother embodiment, the resource rules 171 may be associated with theemail resources 165 according to a listing of associated email resources165 and resource rules 171. In any instance, the resource rules 171 mayregulate access to the email resources 165 associated with the resourcerules 171 by the client devices 120 associated with the email resources165, as described herein.

Next, in step 312, the client side application 126 may determine whetherthe email resources 165 satisfy the resource rules 171 associated withthe email resources 165. In certain embodiments, the client sideapplication 126 may determine that the client device 120 associated withthe email resources 165 is authorized to access the email resources 165if the email resources 165 satisfy the associated resources rules 171.In any instance, the client side application 126 may determine whetherthe state of the email resources 165 satisfies the requirementsspecified by the associated resource rules 171. In particular, theclient side application 126 may determine whether the email headers,email sender fields, email CC fields, email BCC fields, email recipientfields, email subject fields, email bodies, email signatures, emailfooters, and/or email attachments of the email resources 165 satisfy theassociated resource rules 171, as described herein.

If the client side application 126 determines that the email resources165 do not satisfy the resource rules 171, then the client sideapplication 126 may proceed to step 315 and may modify the emailresources 165. In certain embodiments, the client side application 126may modify the email resources 165 so that the email resources 165satisfy the resource rules 171 associated with the email resources 165.In some embodiments, the client side application 126 may modify at leastone portion of the email resources 165. In other embodiments, the accesscontrol service 174 may modify all portions of and/or the entirety ofthe email resources 165. In any instance, the client side application126 may modify the email resources 165 by formatting, encoding,configuring, adding, removing, stripping, moving, replacing and/orflagging portions of the email resources 165, as described herein.

On the contrary, if the client side application 126 determines that theemail resources 165 satisfy the resource rules 171, then the client sideapplication 126 may proceed to step 318 and may authorize the clientdevice 120 to access the email resources 165. In certain embodiments,the client side application 126 may authorize the client device 120 toaccess the email resources 165 by providing the client devices 120 witha means of accessing the email resources 165. For example, the clientside application 126 may enable storing, installing, activating,rendering and/or executing the email resources 165 on the client device120, as described herein. In one embodiment, the client side application126 may authorize the client device 120 to access at least oneunmodified email resource 165. In another embodiment, the client sideapplication 126 may authorize the client device 120 to access at leastone email resource 165 that has been modified by the access controlservice 174 so that the email resources 165 satisfy the resource rules171 associated with the email resources 165. In yet another embodiment,the client side application 126 may authorize the client device 120 toaccess at least one email resource 165 that has been modified by theclient side application 126 so that the email resources 165 satisfy theresource rules 171 associated with the email resources 165.

FIG. 4 is an example of a user interface 137 a that allows anadministrator of an access control service 174 (FIG. 1) to associate atleast one resource rule 171 (FIG. 1) with at least one email resource165 (FIG. 1). In certain embodiments, the user interface 137 a mayinclude a grouping view field 402, a rules view field 404, an add rulesbutton 406, at least one rules description field 408, at least oneaction button 410, and at least one defined rule 412.

The grouping view field 402 may allow the administrator to select agroup of client devices 120 and/or a group of users of client devices120 to manage. For example, the administrator may manipulate theresource rules 171 that apply to the “Enterprise” group of clientdevices 120 by selecting the “Enterprise” grouping from the pull-downprovided by the grouping view field 402. The rules view field 404 mayallow the administrator to filter the resource rules 171 to manage. Forinstance, the administrator may filter the resource rules 171 by eitherselecting the “All Email Rules” set of resource rules 171 or the “ActiveEmail Rules” set of resource rules 171 from the options provided by therules view field 404.

The add rules button 406 may allow the administrator to add new resourcerules 171 to the collection of resource rules 171 that apply to the“Enterprise” group of client devices 120. For example, invoking the addrules button 406 may instruct the access control service 174 to provideanother user interface 137 in which the administrator may define atleast one new resource rule 171, as will be described in FIG. 5. Therules description fields 408 may specify at least one characteristicthat describes each of the resource rules 171. For instance, the rulesdescription fields 408 may include indications of whether a rule isactive 408 a, a name of a rule 408 b, a storage location of a rule 408c, a brief description of a rule 408 d, an assignment of a rule 408 e,an effective date and/or expiration date of a rule 408 f, and a lastmodified date of a rule 408 g. The action buttons 410 may allow anadministrator to take at least one action to a resource rule 171, suchas editing the resource rule 171 and/or adjusting the settings of aresource rule 171. The defined rules 412 may include at least oneresource rule 171 that has been previously created by an administratorof the access control service 174, such as the “Encrypt EmailAttachments” rule 412 a and the “Remove Email Attachments” rule 412 b.

FIG. 5 is an example of a user interface 137 b that allows anadministrator of an access control service 174 (FIG. 1) to create atleast one new resource rule 171 (FIG. 1), which may provide and/orcontrol access to at least one application and/or service accessible toat least one client device 120 (FIG. 1). In certain embodiments, theuser interface 137 b may include a rule type field 502, an accesscredentials field 504, an access rights field 506, and at least oneaction button 508. In some embodiments, the access rights field 506 mayinclude an “Encrypt All Attachments” button 506 a and a “Remove AllAttachments” button 506 b.

The rule type field 502 may include one of more types of resource rules171 that may be created through the user interface 137 b. For example,an administrator of the access control service 174 may select “ExchangeActiveSync” from the rules type field 502 to create resource rules 171associated with email resources 165 (FIG. 1). The access credentialsfield 504 may include at least one field that accepts input of at leastone credential for access to at least one application and/or serviceaccessible to the client devices 120. For instance, an administrator ofthe access control service 174 may input the “Domain,” “Username,”“Email Address,” “Password,” and “Payload Certificates” associated withthe client devices 120. The access rights field 506 may include at leastone access right that may be defined for the client devices 120, whichmay control access by client devices 120 to applications and/orservices. For example, an administrator of the access control service174 may apply at least one access restriction including “Prevent MovingMessages,” “Prevent Use in 3^(rd) Party Apps,” “Disable recent contactsync,” “Encrypt All Attachments” 506 a, and “Remove All Attachments” 506b. The action buttons 508 may include at least one button that savesand/or deletes the resource rules 171 defined in the user interface 137b. For example, an administrator of the access control service 174 mayinvoke the “Save” action button 508 to store the resource rules 171associated with the email resources 165 in the data store 153 (FIG. 1)of the access control server 150 (FIG. 1).

FIG. 6 is an example of a user interface 137 c executed by a client sideapplication 126 (FIG. 1) on a client device 120 (FIG. 1). In certainembodiments, the client side application 126 may be an applicationnative to the client device 120 that is capable of receiving and/orrendering email resources 165. For example, the client side application126 may be a native email application, such as Microsoft Outlook orApple Mail. The client side application 126 may include an emailselection field 602 and an email viewing pane 604. The email selectionfield 602 may include at least one email message that may be selected toaccess within the email viewing pane 604. For example, the user of theclient device, such as “John Smith,” may select an email messageentitled “Confidential—Q3 2012 Revenue” sent to “John Smith” from“George Williams.” The email viewing pane 604 may include a senderfield, a recipient field, a title field, a body field, and at least oneattachment 606. For instance, the email viewing pane 604 may provide auser of a client device 120 to access the attachment entitled“PROTECTED: Q3 2012 Revenue.pdf.”

FIG. 7 is an example of a user interface 137 d executed by a client sideapplication 126 (FIG. 1) on a client device 120 (FIG. 1). In certainembodiments, the client side application 126 may be an applicationnative to the client device 120 that is capable of receiving and/orrendering email resources 165. For example, the client side application126 may be a native email application, such as Microsoft Outlook orApple Mail, as similarly described in FIG. 6. In some embodiments, theuser of the client device 120 may request to access the attachmententitled “PROTECTED: Q3 2012 Revenue.pdf” by selecting the attachment onthe user interface 137 d. In one embodiment, the attachment entitled“PROTECTED: Q3 2012 Revenue.pdf” may be associated with resource rules171 (FIG. 1) that specify that the email resources 165 may only beaccessed via a secure container application.

The user interface 137 d may provide an access selection field 702 toprovide the user of the client device 120 with at least one accessapplication and/or service that is available for accessing the emailresources 165 in accordance with the associated resource rules 171. Forexample, the access selection field 702 may specify that a client sideapplication 126 with secure container capabilities may be selected, aclient side application 126 with native email capabilities may not beselected, and a printing function of the client device 120 may not beselected. By selecting the client side application 126 with securecontainer capabilities from the access selection field 702, the currentclient side application 126 with native email capabilities may call onthe client side application 126 with secure container capabilities inorder to access the email attachment.

FIG. 8 is an example of a user interface 137 e executed by a client sideapplication 126 (FIG. 1) on a client device 120 (FIG. 1). In certainembodiments, the client side application 126 may be a secure containerapplication that is capable of receiving and/or rendering emailresources 165, as described herein. In some embodiments, the userinterface 137 e may provide an authentication form which must be filledout by the user of the client device 120 in order to gain access to atleast one email resource 165 accessible through the secure containerenvironment of the client side application 126. In particular, the userinterface 137 e may provide an authentication form that includes ausername field 802, a password field 804, and a login button 806. A userof the client device 120, such as “John Smith,” may provide a username,such as “John Smith,” in the username field 802, may provide a password,such as “ . . . ,” and may invoke the login button 806 to provide theaccess credentials to the client side application 126. Responsive to adetermination that the access credentials provided by the user of theclient device 120 are authorized, the client side application 126 mayprovide the user of the client device 120 with access to the securecontainer environment of the client side application 126.

FIG. 9 is an example of a user interface 137 f executed by a client sideapplication 126 (FIG. 1) on a client device 120 (FIG. 1). In certainembodiments, the client side application 126 may be a secure containerapplication that is capable of receiving and/or rendering emailresources 165, as described herein. The secure container environment ofthe client side application 126 may include a views pane 902, acategories pane 904, and action buttons 906. The views pane 902 mayinclude at least one view that is accessible to the user of the clientdevice 120, such as an “all content” view, a “new content” view, a“recent activity” view, and a “favorites” view. The user of the clientdevice 120 may select one of the available views, each of which mayinclude a subset of email resources 165 related to the certain view. Thecategories pane 904 may include at least one category of email resources165 that is available to the user of the client device 120, such as an“Email Attachments” category that is a subset of an “Email Resources”category. The user of the client device 120 may, for instance, selectthe “Email Attachments” category to access at least one email attachmentthat is configured to be accessible via the secure container environmentof the client side application 126. The action buttons 906 may include a“Content” button, a “Downloads” button, a “Search” button, an “Updates”button, and a “Settings” button that may launch other user interfaces137 provided by the client side application 126 to enable additionalviews, applications, and/or services.

FIG. 10 is an example of a user interface 137 e executed by a clientside application 126 (FIG. 1) on a client device 120 (FIG. 1). Incertain embodiments, the client side application 126 may be a securecontainer application that is capable of receiving and/or renderingemail resources 165, as described herein. The secure containerenvironment of the client side application 126 may include an accessibleresource listing 1002 and an access notification 1004. The user of theclient device 120 may select an email resource 165, such an as emailattachment, from the accessible resource listing 1002. Responsive to theuser of the client device 120 selecting the “Q3 2012 Revenue.pdf” emailresource 165 from the accessible resource listing 1002, the client sideapplication 126 may provide the user with access to the email resource165 by unlocking the protected file. In particular, the email resource165 may have been encrypted with a symmetric cryptographic key and/or anasymmetric cryptographic key by an access control service 174 (FIG. 1)according to at least one resource rule 171 (FIG. 1) associated with theemail resource 165, as described herein. Consequently, the client sideapplication 126 may decrypt the email resource 165 to enable access tothe email resource 165 and may provide an access notification 1004 thatspecifies that the client side application 126 is “Unlocking (the)PROTECTED file” and to “Please Wait” to access the email resource 165while the client side application 126 unlocks the email resource 165.

FIG. 11 is an example of a user interface 137 e executed by a clientside application 126 (FIG. 1) on a client device 120 (FIG. 1). Incertain embodiments, the client side application 126 may be a securecontainer application that is capable of receiving and/or renderingemail resources 165, as described herein. The client side application126 may include a resource title pane 1102, a resource content pane 1104and a resource page selection pane 1106. The resource title pane 1102may specify the title of the email resources 165, such as “Q3 2012Revenue.” The resource content pane 1104 may include the body of theemail resources 165, such as the pages of the PDF file “Q3 2012Revenue.” The resource page selection pane 1106 may include at least onepage of the email resources 165. The user of the client device 120 may,for example, select a page from the resource page selection pane 1106.Responsive to the user of the client device 120 selecting a certain pagefrom the resource page selection pane 1106, the client side application126 may navigate to the selected page and present the content of theselected page in the resource content pane 1104.

FIG. 12 depicts certain illustrative components for a networkedenvironment 1200 according to various embodiments. In certainembodiments, the networked environment 1200 may include at least onenetwork 110, at least one client device 120, an access control service174, and at least one email service 1202. The email services 1202 may beconfigured to provide the client devices 120 with access to at least oneemail resource 165 (FIG. 1) associated with the email services 1202. Asan example, the email services 1202 may be and/or include at least oneenterprise email service, such as Microsoft Exchange, Lotus Notes,and/or other services capable of distributing email resources 165 toclient devices 120. The access control service 174 may be configured toauthorize the client devices 120 to access to the email services 1202,may control the manner in which the client devices 120 are authorized toaccess the email services 1202, and may provide the client devices 120with access to the email services 1202.

In one embodiment, the access control service 174 may be configured toproxy email resources 165 provided to the client devices 120 by theemail services 1202. The access control service 174 may, for instance,filter all email resources 165 transmitted between the email services1202 and the client devices 120. Alternatively, the access controlservice 174 may proxy email resources 165 in transit to the clientdevices 120 from the email services 1202. In another embodiment, theaccess control service 174 may be configured to provide a gateway foraccess to the email services 1202. The access control service 174 may,for instance, provide authorized client devices 120 with access to theemail services 1202 and deny unauthorized client devices 120 fromaccessing the email services 1202.

In any instance, the access control service 174 may be configured todetermine whether the client devices 120 are authorized to access theemail resources 165. The access control service 174 may, for example,receive at least one request 177 (FIG. 1) to access the email services1202 from the client devices 120. The access control service 174 maydetermine whether the client devices 120 associated with the requests177 are authorized to access the email services 1202 based on, forinstance, at least one device profile 123 (FIG. 1), at least one useridentifier 132 (FIG. 1), at least one device identifier 135 (FIG. 1)associated with the client device 120, which may be included in therequests 177. The access control service 174 may provide the clientdevices 120 with access to the email services 1202 in response to adetermination that the client devices 120 are authorized to access theemail services 1202. In one embodiment, the access control service 174may establish a communicative connection between the email services 1202and the client devices 120, which may facilitate the transmission ofemail resources 165 between the email services 1202 and the clientdevices 120. In another embodiment, the access control service 174 mayestablish a communicative connection between the access control service174 and the client devices 120, which may facilitate the transmission ofemail resources 165 associated with the email service 1202 between theaccess control service 174 and the client devices 120.

Additionally, the access control service 174 may be configured tocontrol access to the email resources 165 by the client devices 120. Theaccess control service 174 may determine which email resources 165 theclient devices 120 are authorized to access. The access control service174 may also modify the email resources 165 before providing the clientdevices 120 with access to the email resources 165.

In certain embodiments, the access control service 174 may determinewhether the email resources 165 are accessible via at least oneunauthorized application on the client devices 120 and may modify theemail resources 165 to be inaccessible via the unauthorizedapplications. In some embodiments, the access control service 174 mayquery a listing of unauthorized applications, may determine whether theemail resources 165 are configured to be accessible via the listedunauthorized applications, and, if so, may modify the email resources165 to be inaccessible via the listed unauthorized applications. In oneembodiment, the access control service 174 may encrypt the emailresources 165 based on at least one encryption key to preventunauthorized applications on the client devices 120 from accessing theemail resources 165. In particular, the email resources 165, onceencrypted, may not be accessed by applications that do not have therequisite decryption key. Thus, the access control service 174 mayencrypt the email resources 165 based on at least one cryptographicschema that is foreign to the unauthorized applications, preventing theunauthorized applications from decrypting the email resources 165, andthereby preventing the unauthorized applications from accessing theemail resources 165. In another embodiment, the access control service174 may modify the file format of the email resources 165 to preventunauthorized applications on the client devices 120 from accessing theemail resources 165. For example, the access control service 174 maydetermine which file formats are accessible by the unauthorizedapplications and change the file formats of the email resources 165 tofile formats that are inaccessible by the unauthorized applications.

Moreover, in certain embodiments, the access control service 174 maymodify the email resources 165 to be accessible via certain authorizedapplications. In some embodiments, the access control service 174 mayquery a listing of authorized applications, may determine whether theemail resources 165 are configured to be accessible via the listedauthorized applications, and, if not, may modify the email resources 165to be accessible via the listed authorized applications. In oneembodiment, the access control service 174 may encrypt the emailresources 165 based on at least one cryptographic key that is associatedwith the authorized applications. Additionally, the access controlservice 174 may transmit the cryptographic key for decryption to theauthorized applications on the client devices 120 so that the authorizedapplications may decrypt and access the email resources 165. In anotherembodiment, the access control service 174 may modify the file format ofthe email resources 165 to permit authorized applications on the clientdevices 120 to access the email resources 165 while preventingunauthorized applications on the client devices 120 from accessing theemail resources 165. For example, the access control service 174 maydetermine which file extensions are accessible by the authorizedapplications and which file extensions are inaccessible by theunauthorized applications to change the file extensions of the emailresources 165 to the identified file extensions to restrict theapplications on the client devices 120 that may access the emailresources 165.

Furthermore, the access control service 174 may be configured to providethe client devices 120 with access to the email services 1202 and/or theemail resources 165 associated with the email services 1202. In oneembodiment, the access control service 174 may be configured to transmitemail resources 165 to the client devices 120. For example, the accesscontrol service 174 may establish a secure communicative connection withthe client devices 120, such as HTTPS/SSL, through which the accesscontrol service 174 may transmit the email resources 165 associated withthe email services 1202 to the client devices 120. In anotherembodiment, the access control service 174 may be further configured totransmit at least one cryptographic key to at least one client sideapplication 126 on the client devices 120 to enable such client sideapplications 126 to access the email resources 165 by decrypting theemail resources 165 with the transmitted cryptographic key.

As an example of the aforementioned embodiments, the access controlservice 174 may proxy at least one email resource 165 from an emailservice to a client device 120. Upon receiving the email resource 165,the access control service 174 may determine whether an administrator ofthe access control service 174 has specified certain applications thatare authorized to access the email resources 165 and certainapplications that are not authorized to access the email resources 165.For instance, the administrator may specify that applications createdin-house may access the email resources 165 and that applicationscreated by out-of-house may not access the email resources 165. Based onthe administrator's specifications, the access control service 174 maymodify the email resources 165 to be accessible via the in-houseapplications and inaccessible via the out-of-house applications. Inparticular, the access control service 174 may modify the emailresources 165 based on an encryption key and/or file format that isforeign to the out-of-house applications. Once the email resources 165are modified, the access control service 174 may transmit the emailresources 165 to the proper client device 120. The access controlservice 174 may also transmit instructions to the in-house applicationson the client device 120, including an appropriate decryption key, toprovide the in-house applications with access to the email resources165. Consequently, the in-house applications on the client device 120may access the email resources 165 by decrypting the email resources 165with the key received from the access control service 174, while theout-of-house applications on the client device 120 cannot access theemail resources 165 due to their inability to decrypt the emailresources 165.

FIG. 13 is a flowchart illustrating exemplary functionality performed byan access control service 174 executed by an access control server 150(FIG. 1) according to certain embodiments. It is understood that theflowchart of FIG. 13 provides merely an example of the many differenttypes of functional arrangements that may be employed to implement theoperation of the access control service 174 as described herein. As analternative, the flowchart of FIG. 13 may be viewed as depicting anexample of steps of a method implemented in the access control server150 according to at least one embodiment.

Beginning with step 1302, the access control service 174 may proxy atleast one email resource 165 (FIG. 1) from at least one email service1202 (FIG. 12) to at least one client device 120 (FIG. 1). In oneembodiment, the access control service 174 may be configured to proxyall data transmitted between the email services 1202 and the clientdevices 120. For example, the access control service 174 may stand infront of the email services 1202, as shown in FIG. 12, to intercept anyemail resources 165 being transmitted from the email services 1202 toclient devices 120. The access control service 174 may further prohibitthe email resources 165 from proceeding to the client devices 120 astransmitted by the email services 1202 according to at least oneresource rule 171 (FIG. 1), as described herein. In another embodiment,the access control service 174 may be configured to act as a gatewaythat controls access to the email services 1202. For instance, theaccess control service 174 may transmit instructions to the emailservices 1202 that specify that email resources 165 intended for theclient devices 120 must be transmitted to the client devices 120 via theaccess control service 174.

Next, in step 1304, the access control service 174 may determine whetherthe email resources 165 are accessible to the client devices 120 via atleast one unauthorized application on the client devices 120. In certainembodiments, at least one resource rule 171 (FIG. 1) may specify thatthe client devices 120 are not authorized to access the email resources165 via certain unauthorized applications on the client devices 120. Insome embodiments, the resource rules 171 may specify a listing ofapplications that are not authorized to access the email resources 165on the client devices 120. In one embodiment, the access control service174 may query the data store 153 (FIG. 1) of the access control server150 to determine whether any such resource rules 171 apply to the emailresources 165. In another embodiment, the access control service 174 mayquery the email services 1202 to determine whether any such resourcerules 171 apply to the email resources 165. In yet another embodiment,the access control service 174 may query the client devices 120 todetermine whether any such resource rules 171 apply to the emailresources 165.

In any instance, the access control service 174 may analyze the state ofthe email resources 165 to determine whether the email resources 165comply with the resource rules 171. In one embodiment, the accesscontrol service 174 may determine whether the email resources 165 areencrypted with at least one cryptographic key that is associated withthe unauthorized applications. For example, the access control service174 may determine whether the email resources 165 may be decrypted bythe unauthorized applications. In another embodiment, the access controlservice 174 may determine whether the file format of the email resources165 is associated with the unauthorized applications. For instance, theaccess control service 174 may determine whether the email resources 165are formatted with a file extension that is readable by the unauthorizedapplications.

If the access control service 174 determines that the email resources165 are not accessible via the unauthorized applications, the accesscontrol service 174 may proceed to step 1306. In particular, if theaccess control service 174 determines that the email resources 165 intheir present state are inaccessible via the unauthorized applications,then the access control service 174 may refrain from modifying the emailresources 165. If, however, the access control service 174 determinesthat the email resources 165 may be accessible via the unauthorizedapplications, then the access control service 174 may proceed to step1308 to prevent the email resources 165 from being accessible via theunauthorized applications on the client devices 120. In certainembodiments, the access control service 174 may modify the emailresources 165 to prevent the email resources 165 from being accessiblevia the unauthorized applications.

In some embodiments, the access control service 174 may encrypt theemail resources 165 based on at least one cryptographic key to preventthe unauthorized applications from accessing the email resources 165.For example, the email resources 165 may be encrypted by the accesscontrol service 174 based at least in part on a cryptographic key thatis foreign to the unauthorized applications, thereby preventing theunauthorized applications from decrypting and accessing the emailresources 165. In one embodiment, the email resources 165 may beencrypted by the access control service 174 based at least in part onthe advanced encryption standard (AES) cryptographic schema. In anotherembodiment, the email resources 165 may be encrypted by the accesscontrol service 174 based at least in part on the data encryptionstandard (AES) cryptographic schema. In any instance, the emailresources 165 may be encrypted, and/or obfuscated, by the access controlservice 174 in a manner that prevents the unauthorized applications onthe client devices 120 from presenting at least one user of the clientdevices 120 with a human-readable version of the email resources 165.

In other embodiments, the access control service 174 may modify the fileformat of the email resources 165 to prevent the unauthorizedapplications from accessing the email resources 165. For instance, theformat of the file extension of the email resources 165 may be changedby the access control service 174 to a format that is foreign to theunauthorized applications, thereby preventing the unauthorizedapplications from interpreting and accessing the email resources 165.Thus, if the unauthorized applications are incapable of reading filesthat are formatted with the “.pdf” file extension, the access controlservice 174 may change the format of email resources 165 to the “.pdf”file extension to prevent the unauthorized applications frominterpreting and accessing the email resources 165.

Additionally, the access control service 174 may determine whether theemail resources 165 may be accessible on the client devices 120 via atleast one authorized application on the client devices 120. In certainembodiments, at least one resource rule 171 may specify that the clientdevices 120 are authorized to access the email resources 165 via certainauthorized applications on the client devices 120. In some embodiments,the resource rules 171 may specify a listing of applications that areauthorized to access the email resources 165 on the client devices 120.In one embodiment, the access control service 174 may query the datastore 153 of the access control server 150 to determine whether any suchresource rules 171 apply to the email resources 165. In anotherembodiment, the access control service 174 may query the email services1202 to determine whether any such resource rules 171 apply to the emailresources 165. In yet another embodiment, the access control service 174may query the client devices 120 to determine whether any such resourcerules 171 apply to the email resources 165.

In any instance, the access control service 174 may analyze the state ofthe email resources 165 to determine whether the email resources 165comply with the resource rules 171. In one embodiment, the accesscontrol service 174 may determine whether the email resources 165 areencrypted with at least one cryptographic key that is associated withthe authorized applications. For example, the access control service 174may determine whether the email resources 165 may be decrypted by theauthorized applications. In another embodiment, the access controlservice 174 may determine whether the file format of the email resources165 is associated with the authorized applications. For instance, theaccess control service 174 may determine whether the email resources 165are formatted with a file extension that is readable by the authorizedapplications.

If the access control service 174 determines that the email resources165 are accessible via the authorized applications, the access controlservice 174 may refrain from modifying the email resources 165. If,however, the access control service 174 determines that the emailresources 165 are not accessible via the authorized applications, thenthe access control service 174 may enable the email resources 165 to beaccessible via the authorized applications on the client devices 120. Incertain embodiments, the access control service 174 may modify the emailresources 165 to permit the email resources 165 to be accessible via theauthorized applications.

In some embodiments, the access control service 174 may encrypt theemail resources 165 based on at least one cryptographic key to enablethe authorized applications to access the email resources 165. Forexample, the email resources 165 may be encrypted by the access controlservice 174 based at least in part on a cryptographic key that is nativeto the authorized applications, thereby enabling the authorizedapplications to decrypt and access the email resources 165. In oneembodiment, the email resources 165 may be encrypted by the accesscontrol service 174 based at least in part on the advanced encryptionstandard (AES) cryptographic schema. In another embodiment, the emailresources 165 may be encrypted by the access control service 174 basedat least in part on the data encryption standard (AES) cryptographicschema. In any instance, the email resources 165 may be encrypted,and/or obfuscated, by the access control service 174 in a manner thatenables the authorized applications to present at least one user of theclient devices 120 with a human-readable version of the email resources165.

In other embodiments, the access control service 174 may modify the fileformat of the email resources 165 to enable the authorized applicationsto access the email resources 165. For instance, the format of the fileextension of the email resources 165 may be changed to a format that isnative to the authorized applications, thereby enabling the authorizedapplications to interpret and access the email resources 165. Thus, ifthe authorized applications are capable of reading files that areformatted with the “.pdf” file extension, the access control service 174may change the format of email resources 165 to the “.pdf” fileextension to enable the authorized applications to interpret and accessthe email resources 165.

Furthermore, the access control service 174 may authorize the clientdevices 120 to access the email resources 165. In certain embodiments,the access control service 174 may be configured to transmit at leastone email resource 165 to the client devices 120. In one embodiment, theaccess control service 174 may transmit at least one email resource 165to the client devices 120 that has been modified to be inaccessible bythe client devices 120 via at least one unauthorized application on theclient devices 120 and/or has been modified to be accessible by theclient devices 120 via at least one authorized application on the clientdevices 120. In another embodiment, the access control service 174 maytransmit at least one email resource 165 to the client devices 120 thathas been modified to be accessible by the client devices 120 via atleast one authorized application on the client devices 120 and/or thathas been modified to be accessible by the client devices 120 via atleast one authorized application on the client devices 120.

In some embodiments, the access control service 174 may be furtherconfigured to transmit at least one instruction to at least one clientside application 126 on the client devices 120 that specifies the mannerin which the client side applications 126 are authorized to access theemail resources 165. In one embodiment, the instructions may specifyand/or include at least one resource rule 171, as described herein. Inanother embodiment, the instructions may include at least onecryptographic key that may be used by the client side applications 126to decrypt and access the email resources 165.

FIG. 14 depicts certain illustrative components for a networkedenvironment 1400 according to various embodiments. In certainembodiments, the networked environment 100 may include at least onenetwork 110, at least one client device 120, an access control service174, and at least one email service 1202. The networked environment 1400may be similar to the networked environment 1200 in FIG. 12. While thenetworked environment 1200 may include the same components as thenetworked environment 1400, the organization of the components of thetwo networked environment may differ as shown. In particular, the emailservices 1202 in the networked environment 1400 may communicate directlywith the client devices 120, whereas the access control service 174 inthe networked environment 1200 must relay all communications between theemail services 1202 and client devices 120. The access control service174 of the networked environment 1400 may be configured to determinewhich email resources 165 associated with the email services 1202 may beaccessed by the client devices 120, control the manner in which theclient devices 120 are authorized to access the email resources 165, andmay provide the client devices 120 with access to the email resources165.

In certain embodiments, the access control service 174 may determinewhich email resources 165 associated with the email services 1202 may beaccessed by the client devices 120 by configuring the email services1202. In some embodiments, the access control service 174 may transmitat least one instruction to the email services 1202 that configures thefunctionality of the email services 1202. As an example, the accesscontrol service 174 may utilize an instruction protocol, such asMicrosoft PowerShell, to transmit the instructions to an email service1202, such as a Microsoft Exchange Server. In one embodiment, theinstructions may specify that the email resources 165 may be accessed bycertain authorized applications on the client devices 120 and may not beaccessed by certain unauthorized applications on the client devices 120.In another embodiment, the instructions may include at least onecryptographic key and/or file format with which the associated emailresources 165 must be modified before the client devices 120 areauthorized to access the email resources 165, as described herein. Inany instance, the instructions may represent and/or specify at least oneresource rule 171 (FIG. 1) associated with the email resources 165 thatmust be satisfied in order for the client devices 120 to be authorizedto access the email resources 165, as described herein. Upon receivingthe instructions from the access control service 174, the email services1202 may execute the instructions on behalf of the access controlservice 174. Consequently, while the access control service 174 may nothave any direct control over the email resources 165 in the networkedenvironment 1400, the access control service 174 may nevertheless ensurethat the email resources 165 are configured in accordance with certainspecifications by remotely configuring the functionality of the emailservices 1202.

Similarly, in certain embodiments, the access control service 174 maydetermine which email resources 165 associated with the email services1202 may be accessed by the client devices 120 by configuring at leastone client side application 126 on the client devices 120. For instance,the access control service 174 may be associated with a “containerized”client side application 126 on the client devices 120 that is configuredto receive at least one email resource 165 from the email services 1202and control the manner in which other applications on the client devices120 access the email resources 165 in accordance with instructions fromthe access control service 174. As described herein, the instructionsmay represent at least one resource rule 171 that specifies that theemail resources 165 may be accessed by certain authorized applicationson the client devices 120 and may not be accessed by certainunauthorized applications on the client devices 120, and may include atleast one cryptographic key and/or file format with which the emailresources 165 must be modified before the client devices 120 areauthorized to access the email resources 165.

Upon receiving the instructions from the access control service 174, theclient side applications 126 may execute the instructions on behalf ofthe access control service 174. In one embodiment, the client sideapplication 126 may encrypt the email resources 165 based on at leastone cryptographic key to prevent the email resources 165 from beingaccessible by unauthorized applications on the client device 120. Inanother embodiment, the client side application 126 may encrypt theemail resources 165 based on at least one cryptographic key to enablethe email resources 165 to be accessible by authorized applications onthe client device 120. In yet another embodiment, the client sideapplication 126 may transmit at least one cryptographic key used toencrypt the email resources 165 to at least one authorized applicationon the client device 120 to enable the authorized applications to accessthe email resources 165. Thus, while the access control service 174 maynot have any direct control over the email resources 165 in thenetworked environment 1400, the access control service 174 maynevertheless ensure that the email resources 165 are configured inaccordance with certain specifications by remotely configuring thefunctionality of the client side applications 126 on the client devices120.

FIG. 15 is a flowchart illustrating exemplary functionality performed bya client side application 126 executed by a client device 120 (FIG. 1)according to certain embodiments. It is understood that the flowchart ofFIG. 15 provides merely an example of the many different types offunctional arrangements that may be employed to implement the operationof the client side application 126 as described herein. As analternative, the flowchart of FIG. 15 may be viewed as depicting anexample of steps of a method implemented in the client device 120according to at least one embodiment.

Beginning with step 1502, the client side application 126 may identifyat least one email resource 165 (FIG. 1) on the client device 120. Inone embodiment, the client side application 126 may be configured toidentify email resources 165 on the client device 120 by querying thedata store 122 (FIG. 1) of the client device 120 to determine whetherthe data store 122 contains any email resources 165. In anotherembodiment, the client side application 126 may be configured toidentify email resources 165 on the client device 120 by receiving atleast one transmission of the email resources 165 from at least oneaccess control service 174 (FIGS. 1,12,14) and/or at least one emailservice 1202 (FIGS. 12,14), as described herein. In yet anotherembodiment, the client side application 126 may be configured toidentify email resources 165 on the client device 120 by determiningwhether other applications on the client device 120 have access to atleast one email resource 165.

Next, in step 1504, the client side application 126 may determinewhether the email resources 165 are accessible to the client devices 120via at least one unauthorized application on the client devices 120. Incertain embodiments, at least one resource rule 171 (FIG. 1) may specifythat the client devices 120 are not authorized to access the emailresources 165 via certain unauthorized applications on the clientdevices 120. In some embodiments, the resource rules 171 may specify alisting of applications that are not authorized to access the emailresources 165 on the client devices 120. In one embodiment, the clientside application 126 may query the data store 122 of the client device120 to determine whether any such resource rules 171 apply to the emailresources 165. In another embodiment, the client side application 126may query at least one access control service 174 and/or at least oneemail service 1202 associated with the email resources 165 to determinewhether any such resource rules 171 apply to the email resources 165.For instance, the client side application 126 may query the accesscontrol service 174 and/or email service 1202 from which the client sideapplication 126 received a transmission of email resources 165 todetermine whether resource rules 171 apply to such email resources 165.

In any instance, the client side application 126 may analyze the stateof the email resources 165 to determine whether the email resources 165comply with the resource rules 171. In one embodiment, the client sideapplication 126 may determine whether the email resources 165 areencrypted based at least in part on at least one cryptographic key thatis associated with the unauthorized applications. For example, theclient side application 126 may determine whether the email resources165 may be decrypted by the unauthorized applications. In anotherembodiment, the client side application 126 may determine whether thefile format of the email resources 165 is associated with theunauthorized applications. For instance, the client side application 126may determine whether the email resources 165 are formatted with a fileextension that is readable by the unauthorized applications.

If the client side application 126 determines that the email resources165 are not accessible via the unauthorized applications, the clientside application 126 may proceed to step 1506. In particular, if theclient side application 126 determines that the email resources 165 intheir present state are inaccessible via the unauthorized applications,then the client side application 126 may refrain from modifying theemail resources 165. If, however, the client side application 126determines that the email resources 165 may be accessible via theunauthorized applications, then the client side application 126 mayproceed to step 1508 to prevent the email resources 165 from beingaccessible via the unauthorized applications on the client devices 120.In certain embodiments, the client side application 126 may modify theemail resources 165 to prevent the email resources 165 from beingaccessible via the unauthorized applications.

In some embodiments, the client side application 126 may encrypt theemail resources 165 based on at least one cryptographic key to preventthe unauthorized applications from accessing the email resources 165.For example, the email resources 165 may be encrypted by the client sideapplication 126 based at least in part on a cryptographic key that isforeign to the unauthorized applications, thereby preventing theunauthorized applications from decrypting and accessing the emailresources 165. In one embodiment, the email resources 165 may beencrypted by the client side application 126 based at least in part onthe advanced encryption standard (AES) cryptographic schema. In anotherembodiment, the email resources 165 may be encrypted by the client sideapplication 126 based at least in part on the data encryption standard(AES) cryptographic schema. In any instance, the email resources 165 maybe encrypted, and/or obfuscated, by the client side application 126 in amanner that prevents the unauthorized applications from presenting atleast one user of the client devices 120 with a human-readable versionof the email resources 165.

In other embodiments, the client side application 126 may modify thefile format of the email resources 165 to prevent the unauthorizedapplications from accessing the email resources 165. For instance, theformat of the file extension of the email resources 165 may be changedby the client side application 126 to a format that is foreign to theunauthorized applications, thereby preventing the unauthorizedapplications from interpreting and accessing the email resources 165.Thus, if the unauthorized applications are incapable of reading filesthat are formatted with the “.pdf” file extension, the client sideapplication 126 may change the format of email resources 165 to the“.pdf” file extension to prevent the unauthorized applications frominterpreting and accessing the email resources 165.

Additionally, the client side application 126 may determine whether theemail resources 165 may be accessible on the client devices 120 via atleast one authorized application on the client devices 120. In certainembodiments, at least one resource rule 171 may specify that the clientdevices 120 are authorized to access the email resources 165 via certainauthorized applications on the client devices 120. In some embodiments,the resource rules 171 may specify a listing of applications that areauthorized to access the email resources 165 on the client devices 120.In one embodiment, the client side application 126 may query the datastore 122 of the client device 120 to determine whether any suchresource rules 171 apply to the email resources 165. In anotherembodiment, the client side application 126 may query at least oneaccess control service 174 and/or at least one email service 1202associated with the email resources 165 to determine whether any suchresource rules 171 apply to the email resources 165. For instance, theclient side application 126 may query the access control service 174and/or email service 1202 from which the client side application 126received a transmission of email resources 165 to determine whetherresource rules 171 apply to such email resources 165.

In any instance, the client side application 126 may analyze the stateof the email resources 165 to determine whether the email resources 165comply with the resource rules 171. In one embodiment, the client sideapplication 126 may determine whether the email resources 165 areencrypted based on at least one cryptographic key that is associatedwith the authorized applications. For example, the client sideapplication 126 may determine whether the email resources 165 may bedecrypted by the authorized applications. In another embodiment, theclient side application 126 may determine whether the file format of theemail resources 165 is associated with the authorized applications. Forinstance, the client side application 126 may determine whether theemail resources 165 are formatted with a file extension that is readableby the authorized applications.

If the client side application 126 determines that the email resources165 are accessible via the authorized applications, the client sideapplication 126 may refrain from modifying the email resources 165. If,however, the client side application 126 determines that the emailresources 165 are not accessible via the authorized applications, thenthe client side application 126 may enable the email resources 165 to beaccessible via the authorized applications on the client devices 120. Incertain embodiments, the client side application 126 may modify theemail resources 165 to permit the email resources 165 to be accessiblevia the authorized applications.

In some embodiments, the client side application 126 may encrypt theemail resources 165 based on at least one cryptographic key to enablethe authorized applications to access the email resources 165. Forexample, the email resources 165 may be encrypted by the client sideapplication 126 based at least in part on a cryptographic key that isnative to the authorized applications, thereby enabling the authorizedapplications to decrypt and access the email resources 165. In oneembodiment, the email resources 165 may be encrypted by the client sideapplication 126 based at least in part on the advanced encryptionstandard (AES) cryptographic schema. In another embodiment, the emailresources 165 may be encrypted by the client side application 126 basedat least in part on the data encryption standard (AES) cryptographicschema. In any instance, the email resources 165 may be encrypted,and/or obfuscated, by the client side application 126 in a manner thatenables the authorized applications to present at least one user of theclient devices 120 with a human-readable version of the email resources165.

In other embodiments, the client side application 126 may modify thefile format of the email resources 165 to enable the authorizedapplications to access the email resources 165. For instance, the formatof the file extension of the email resources 165 may be changed by theclient side application 126 to a format that is native to the authorizedapplications, thereby enabling the authorized applications to interpretand access the email resources 165. Thus, if the authorized applicationsare capable of reading files that are formatted with the “.pdf” fileextension, the client side application 126 may change the format ofemail resources 165 to the “.pdf” file extension to enable theauthorized applications to interpret and access the email resources 165.

Furthermore, the client side application 126 may authorize the clientdevice 120 to access the email resources 165. In certain embodiments,the client side application 126 may be configured to transmit at leastone email resource 165 to at least one other application on the clientdevice 120. In one embodiment, the client side application 126 maytransmit at least one email resource 165 to at least one otherapplication on the client device 120 that has been modified to beinaccessible by the client device 120 via at least one unauthorizedapplication on the client device 120 and/or has been modified to beaccessible by the client device 120 via at least one authorizedapplication on the client device 120. In another embodiment, the clientside application 126 may transmit at least one email resource 165 to atleast one other application on the client device 120 that has beenmodified to be accessible by the client device 120 via at least oneauthorized application on the client device 120 and/or has been modifiedto be accessible by the client device 120 via at least one authorizedapplication on the client device 120. In yet another embodiment, theclient side application 126 may transmit at least one email resource 165to the data store 122 of the client device 120 has been modified to beinaccessible by the client device 120 via at least one unauthorizedapplication on the client device 120 and/or has been modified to beaccessible by the client device 120 via at least one authorizedapplication on the client device 120.

In some embodiments, the client side application 126 may be furtherconfigured to transmit at least one instruction to at least one otherapplication on the client device 120 that specifies the manner in whichthe applications are authorized to access the email resources 165. Inone embodiment, the instructions may specify and/or include at least oneresource rule 171, as described herein. In another embodiment, theinstructions may include at least one cryptographic key that may be usedby the applications to decrypt and access the email resources 165.

FIG. 16 is a flowchart illustrating exemplary functionality performed bya computing system according to certain embodiments. For example, thecomputing system may be and/or include include an access control service174 executed by an access control server 150 (FIG. 1) and/or a clientside application 126 executed by a client device 120 (FIG. 1), asdescribed herein. It is understood that the flowchart of FIG. 16provides merely an example of the many different types of functionalarrangements that may be employed to implement the operation of thecomputer system as described herein. As an alternative, the flowchart ofFIG. 16 may be viewed as depicting an example of steps of a methodimplemented in the computing system according to at least oneembodiment.

Beginning with step 1602, the computing system may identify at least oneemail resource 165 (FIG. 1). In one embodiment, the computing system mayidentify email resources 165 by receiving the email resources 165 froman email service 1202 (FIGS. 12, 14), access control service 174, and/orclient device 120 associated with the email resources 165. In anotherembodiment, the computing system may query the data stores of an emailserver, access control server 150, and/or client device 120 to determinewhether the data stores hold email resources 165.

Next, in step 1604, the computing system may determine whether the emailresources 165 are accessible to at least one client device 120 via atleast one unauthorized application on the client devices 120. Asdescribed herein, at least one resource rule 171 (FIG. 1) may specifythat client devices 120 are not authorized to access the email resources165 via certain unauthorized applications on the client devices 120,which may include a listing of certain unauthorized applications. Incertain embodiments, the computing system may receive at least oneresource rule 171 associated with the email resources 165 from an emailservice 1202 (FIGS. 12, 14), access control service 174, and/or clientdevice 120 associated with the email resources 165. In some embodiments,the computing system may query the data stores of an email service 1202(FIGS. 12, 14), access control service 174, and/or client device 120associated with the email resources 165 to determine whether the datastores hold resource rules 171 associated with the email resources 165.

In any instance, the computing system may analyze the state of the emailresources 165 to determine whether the email resources 165 comply withthe resource rules 171. In one embodiment, the computing system maydetermine whether the email resources 165 are encrypted based at leastin part on at least one cryptographic key that is associated with theunauthorized applications, which may determine whether the emailresources 165 may be decrypted by the unauthorized applications. Inanother embodiment, the computing system may determine whether the fileformat of the email resources 165 is associated with the unauthorizedapplications, which may determine whether the email resources 165 areformatted with a file extension that is readable by the unauthorizedapplications.

If the computing system determines that the email resources 165 are notaccessible via the unauthorized applications, the computing system mayproceed to step 1606. In particular, if the computing system determinesthat the email resources 165 in their present state are inaccessible viathe unauthorized applications on client devices 120, then the computingsystem may refrain from modifying the email resources 165. If, however,the computing system determines that the email resources 165 may beaccessible via the unauthorized applications on client devices 120, thenthe computing system may proceed to step 1608 to prevent the emailresources 165 from being accessible via the unauthorized applications onthe client devices 120.

In certain embodiments, the computing system may modify the emailresources 165 to prevent the email resources 165 from being accessiblevia the unauthorized applications on the client devices 120. In someembodiments, the computing system may encrypt the email resources 165based on at least one cryptographic key to prevent the unauthorizedapplications from accessing the email resources 165, such as acryptographic key that is foreign to the unauthorized applications toprevent the unauthorized applications from decrypting and accessing theemail resources 165. For instance, the email resources 165 may beencrypted by the computing system based at least in part on the advancedencryption standard (AES) cryptographic schema and/or the dataencryption standard (AES) cryptographic schema. In any instance, theemail resources 165 may be encrypted, and/or obfuscated, by thecomputing system in a manner that prevents the unauthorized applicationsfrom presenting at least one user of the client devices 120 with ahuman-readable version of the email resources 165. In other embodiments,the computing system may modify the file format of the email resources165 to prevent the unauthorized applications on the client devices 120from accessing the email resources 165. For instance, the format of thefile extension of the email resources 165 may be changed by thecomputing system to a format that is foreign to the unauthorizedapplications, thereby preventing the unauthorized applications frominterpreting and accessing the email resources 165.

Additionally, the computing system may determine whether the emailresources 165 may be accessible on the client devices 120 via at leastone authorized application on the client devices 120. As describedherein, at least one resource rule 171 may specify that the clientdevices 120 are authorized to access the email resources 165 via certainauthorized applications on the client devices 120, which may include alisting of applications that are authorized to access the emailresources 165 on the client devices 120. Consequently, the computingsystem may analyze the state of the email resources 165 to determinewhether the email resources 165 comply with the resource rules 171. Inone embodiment, the computing system may determine whether the emailresources 165 are encrypted based at least in part on at least onecryptographic key that is associated with the authorized applications,which may determine whether the email resources 165 may be decrypted bythe authorized applications. In another embodiment, the computing systemmay determine whether the file format of the email resources 165 isassociated with the authorized applications, which may determine whetherthe email resources 165 are formatted with a file extension that isreadable by the authorized applications.

If the computing system determines that the email resources 165 areaccessible via the authorized applications, the computing system mayrefrain from modifying the email resources 165. If, however, thecomputing system determines that the email resources 165 are notaccessible via the authorized applications, then the computing systemmay enable the email resources 165 to be accessible via the authorizedapplications on the client devices 120.

In certain embodiments, the computing system may modify the emailresources 165 to permit the email resources 165 to be accessible via theauthorized applications on the client devices 120. In some embodiments,the computing system may encrypt the email resources 165 based on atleast one cryptographic key to enable the authorized applications toaccess the email resources 165, such as with a cryptographic key that isnative to the authorized applications that enables the authorizedapplications to decrypt and access the email resources 165. In otherembodiments, the computing system may modify the file format of theemail resources 165 to enable the unauthorized applications on theclient devices 120 to access the email resources 165, such as to aformat that is native to the authorized applications to prevent theauthorized applications to interpret and access the email resources 165.

Furthermore, the computing system may authorize the client devices 120to access the email resources 165. In certain embodiments, the computingsystem may be configured to transmit at least one email resource 165 tothe client devices 120, such as email resources 165 that have beenmodified to be inaccessible by the client devices 120 via at least oneunauthorized application on the client devices 120 and/or have beenmodified to be accessible by the client devices 120 via at least oneauthorized application on the client devices 120. In some embodiments,the computing system may be further configured to transmit at least oneinstruction to at least one client side application 126 on the clientdevices 120 that specifies the manner in which the client sideapplications 126 are authorized to access the email resources 165, whichmay include at least one resource rule 171 and/or at least onecryptographic key that may be used by the client side applications 126to decrypt and access the email resources 165 on the client devices 120as described herein.

FIG. 17 shows schematic block diagrams of an exemplary access controlserver 150 and an exemplary client device 120 according to an embodimentof the present disclosure. The access control server 150 includes atleast one processor circuit, for example, having a processor 1703 and amemory 1706, both of which are coupled to a local interface 1709. Tothis end, the access control server 150 may comprise, for example, atleast one server computer or like device. Similarly, the client device120 includes at least one processor circuit, for example, having aprocessor 1753 and a memory 1756, both of which are coupled to a localinterface 1759. Additionally, the client device 120 may be in datacommunication with a display 136 for rendering user interfaces 137(FIG. 1) and at least one other I/O device 1763 for inputting andoutputting data. To this end, the client device 120 may comprise, forexample, at least one client computer or like device.

The following is a general discussion of the components of the accesscontrol server 150 and the client device 120. The local interface 1709and 1759 may comprise, for example, a data bus with an accompanyingaddress/control bus or other bus structure as can be appreciated. Storedin the memory 1706 and 1756 are both data and several components thatare executable by the processors 1703 and 1753. In particular, withregard to the access control server 150, stored in the memory 1706 andexecutable by the processor 1703 are an access control service 174 andpotentially other applications. Additionally, with regard to the clientdevice 120, stored in the memory 1756 and executable by the processor1753 are a client side application 126 and potentially otherapplications. Also stored in the memory 1706 and 1756 may be a datastore 153 and 122 and other data. In addition, an operating system maybe stored in the memory 1706 and 1756 and executable by the processor1703 and 1753.

It is to be understood that there may be other applications that arestored in the memory 1706 and 1756 and are executable by the processor1703 and 1753 as can be appreciated. Where any component discussedherein is implemented in the form of software, any one of a number ofprogramming languages may be employed such as, for example, C, C++, C#,Objective C, Java, JavaScript, Perl, PHP, Visual Basic, Python, Ruby,Delphi, Flash, or other programming languages.

A number of software components are stored in the memory 1706 and 1756and are executable by the processor 1703 and 1753. In this respect, theterm “executable” means a program file that is in a form that canultimately be run by the processor 1703 and 1753. Examples of executableprograms may be, for example, a compiled program that can be translatedinto machine code in a format that can be loaded into a random accessportion of the memory 1706 and 1756 and run by the processor 1703 and1753, source code that may be expressed in proper format such as objectcode that is capable of being loaded into a random access portion of thememory 1706 and 1756 and executed by the processor 1703 and 1753, orsource code that may be interpreted by another executable program togenerate instructions in a random access portion of the memory 1706 and1756 to be executed by the processor 1703 and 1753, etc. An executableprogram may be stored in any portion or component of the memory 1706 and1756 including, for example, random access memory (RAM), read-onlymemory (ROM), hard drive, solid-state drive, USB flash drive, memorycard, optical disc such as compact disc (CD) or digital versatile disc(DVD), floppy disk, magnetic tape, or other memory components.

The memory 1706 and 1756 are defined herein as including both volatileand nonvolatile memory and data storage components. Volatile componentsare those that do not retain data values upon loss of power. Nonvolatilecomponents are those that retain data upon a loss of power. Thus, thememory 1706 and 1756 may comprise, for example, random access memory(RAM), read-only memory (ROM), hard disk drives, solid-state drives, USBflash drives, memory cards accessed via a memory card reader, floppydisks accessed via an associated floppy disk drive, optical discsaccessed via an optical disc drive, magnetic tapes accessed via anappropriate tape drive, and/or other memory components, or a combinationof any two or more of these memory components. In addition, the RAM maycomprise, for example, static random access memory (SRAM), dynamicrandom access memory (DRAM), or magnetic random access memory (MRAM) andother such devices. The ROM may comprise, for example, a programmableread-only memory (PROM), an erasable programmable read-only memory(EPROM), an electrically erasable programmable read-only memory(EEPROM), or other like memory device.

Also, the processor 1703 and 1753 may represent multiple processors, andthe memory 1706 and 1756 may represent multiple memories that operate inparallel processing circuits, respectively. In such a case, the localinterface 1709 and 1759 may be an appropriate network 110 (FIG. 1) thatfacilitates communication between any two of the multiple processors1703 and 1753, or between any two of the memory 1706 and 1756, etc. Thelocal interface 1709 and 1759 may comprise additional systems designedto coordinate this communication, including, for example, performingload balancing. The processor 1703 and 1753 may be of electrical or ofsome other available construction.

Although the access control service 174, client side application 126,and other various systems described herein may be embodied in softwareor code executed by general purpose hardware as discussed above, as analternative the same may also be embodied in dedicated hardware or acombination of software/general purpose hardware and dedicated hardware.If embodied in dedicated hardware, each can be implemented as a circuitor state machine that employs any one of or a combination of a number oftechnologies. These technologies may include, but are not limited to,discrete logic circuits having logic gates for implementing variouslogic functions upon an application of at least one data signal,application specific integrated circuits having appropriate logic gates,or other components, etc. Such technologies are generally well known bythose skilled in the art and, consequently, are not described in detailherein.

The flowcharts of FIGS. 2, 3, 13 and 15 show certain functionality andoperations performed by the access control service 174 and client sideapplication 126, respectively. If embodied in software, each box mayrepresent a module, segment, or portion of code that comprises programinstructions to implement the specified logical function(s). The programinstructions may be embodied in the form of source code that compriseshuman-readable statements written in a programming language or machinecode that comprises numerical instructions recognizable by a suitableexecution system such as a processor 1703 and 1753 in a computer systemor other system. The machine code may be converted from the source code,etc. If embodied in hardware, each block may represent a circuit or anumber of interconnected circuits to implement the specified logicalfunction(s).

Although the flowcharts of FIGS. 2, 3, 13 and 15 show a specific orderof execution, it is understood that the order of execution may differfrom that which is depicted. For example, the order of execution of twoor more steps may be scrambled relative to the order shown. Also, two ormore blocks shown in succession in FIGS. 2, 3, 13 and 15 may be executedconcurrently or with partial concurrence. Further, in some embodiments,at least one of the steps shown in FIGS. 2, 3, 13 and 15 may be skippedor omitted. In addition, any number of counters, state variables,warning semaphores, or messages might be added to the logical flowdescribed herein, for purposes of enhanced utility, accounting,performance measurement, or providing troubleshooting aids, etc. It isunderstood that all such variations are within the scope of the presentdisclosure.

Also, any logic or application described herein, including the accesscontrol service 174 and the client side application 126, that comprisessoftware or code can be embodied in any non-transitory computer-readablemedium for use by or in connection with an instruction execution systemsuch as, for example, a processor 1703 and 1753 in a computer system orother system. In this sense, the logic may comprise, for example,statements including instructions and declarations that can be fetchedfrom the computer-readable medium and executed by the instructionexecution system. In the context of the present disclosure, a“computer-readable medium” can be any medium that can contain, store, ormaintain the logic or application described herein for use by or inconnection with the instruction execution system. The computer-readablemedium can comprise any one of many physical media such as, for example,magnetic, optical, or semiconductor media. More specific examples of asuitable computer-readable medium would include, but are not limited to,magnetic tapes, magnetic floppy diskettes, magnetic hard drives, memorycards, solid-state drives, USB flash drives, or optical discs. Also, thecomputer-readable medium may be a random access memory (RAM) including,for example, static random access memory (SRAM) and dynamic randomaccess memory (DRAM), or magnetic random access memory (MRAM). Inaddition, the computer-readable medium may be a read-only memory (ROM),a programmable read-only memory (PROM), an erasable programmableread-only memory (EPROM), an electrically erasable programmableread-only memory (EEPROM), or other type of memory device.

It should be emphasized that the above-described embodiments of thepresent disclosure are merely possible examples of implementations setforth for a clear understanding of the principles of the disclosure.Many variations and modifications may be made to the above- describedembodiment(s) without departing substantially from the spirit andprinciples of the disclosure. All such modifications and variations areintended to be included herein within the scope of this disclosure andprotected by the following claims.

The claimed invention is:
 1. A method for managing access to contentassociated with email by an access control server, comprising: obtainingan email message for transmission to a client, the email messageobtained from an email server, wherein the access control server isconfigured to proxy email messages from the email server to a clientdevice; determining that access to the email message should berestricted to an authorized email client installed on the client device;generating a modified email message based upon the email message,wherein access to content of the modified email message is inaccessibleby an unauthorized application installed on the client device; andtransmitting the modified email message to the client device, whereinaccess to the email message is restricted to the authorized email clientinstalled on the client device.
 2. The method of claim 1, whereingenerating the modified email message further comprises: removing aportion of a body of the email message from the modified email message;encrypting the portion of the body of the email message; and includingthe encrypted portion of the body to the modified email message.
 3. Themethod of claim 1, further comprising transmitting at least oneinstruction to the client device, wherein the at least one instructioncomprises an encryption key with which the modified email message can bedecrypted by the authorized email client.
 4. The method of claim 3,wherein the encryption key is inaccessible to the unauthorizedapplication installed on the client device.
 5. The method of claim 1,wherein determining that access to the email message should berestricted to the authorized email client comprises determining that acontent-type resource rule specifies that a particular keyword appearsin at least one of a body or an attachment of the email message.
 6. Themethod of claim 1, wherein determining that access to the email messageshould be restricted to the authorized email client comprisesdetermining that a property of a sender of the email message isassociated with a particular domain, a particular username, or aparticular email address.
 7. The method of claim 1, wherein generatingthe modified email message further comprises: removing an attachmentfrom the email message; generating a modified attachment by at least oneof encrypting the attachment or modifying a file format of theattachment; and including the modified attachment as an attachment tothe modified email message.
 8. A non-transitory computer-readable mediumcomprising a program which, when executed by a processor, manage accessto content associated with email by an access control server and causedthe processor to at least: obtain an email message for transmission to aclient, the email message obtained from an email server, wherein theaccess control server is configured to proxy email messages from theemail server to a client device; determine that access to the emailmessage should be restricted to an authorized email client installed onthe client device; generate a modified email message based upon theemail message, wherein access to content of the modified email messageis inaccessible by an unauthorized application installed on the clientdevice; and transmit the modified email message to the client device,wherein access to the email message is restricted to the authorizedemail client installed on the client device.
 9. The non-transitorycomputer-readable medium of claim 8, wherein the modified email messageis generated by: removing a portion of a body of the email message fromthe modified email message; encrypting the portion of the body of theemail message; and including the encrypted portion of the body to themodified email message.
 10. The non-transitory computer-readable mediumof claim 8, wherein the program, when executed, transmits at least oneinstruction to the client device, wherein the at least one instructioncomprises an encryption key with which the modified email message can bedecrypted by the authorized email client.
 11. The non-transitorycomputer-readable medium of claim 10, wherein the encryption key isinaccessible to the unauthorized application installed on the clientdevice.
 12. The non-transitory computer-readable medium of claim 8,wherein the program determines that access to the email message shouldbe restricted to the authorized email client by determining that acontent-type resource rule specifies that a particular keyword appearsin at least one of a body or an attachment of the email message.
 13. Thenon-transitory computer-readable medium of claim 8, wherein the programdetermines that access to the email message should be restricted to theauthorized email client by determining that a property of a sender ofthe email message is associated with a particular domain, a particularusername, or a particular email address.
 14. The non-transitorycomputer-readable medium of claim 8, wherein the program generates themodified email message by: removing an attachment from the emailmessage; generating a modified attachment by at least one of encryptingthe attachment or modifying a file format of the attachment; andincluding the modified attachment as an attachment to the modified emailmessage.
 15. An access control server that manages access to contentassociated with email by an access control server, the access controlserver executing an application that is configured to at least: obtainan email message for transmission to a client, the email messageobtained from an email server, wherein the access control server isconfigured to proxy email messages from the email server to a clientdevice; determine that access to the email message should be restrictedto an authorized email client installed on the client device; generate amodified email message based upon the email message, wherein access tocontent of the modified email message is inaccessible by an unauthorizedapplication installed on the client device; and transmit the modifiedemail message to the client device, wherein access to the email messageis restricted to the authorized email client installed on the clientdevice.
 16. The access control server of claim 15, wherein the modifiedemail message is generated by: removing a portion of a body of the emailmessage from the modified email message; encrypting the portion of thebody of the email message; and including the encrypted portion of thebody to the modified email message.
 17. The access control server ofclaim 15, wherein the application, when executed, transmits at least oneinstruction to the client device, wherein the at least one instructioncomprises an encryption key with which the modified email message can bedecrypted by the authorized email client.
 18. The access control serverof claim 17, wherein the encryption key is inaccessible to theunauthorized application installed on the client device.
 19. The accesscontrol server of claim 15, wherein the program determines that accessto the email message should be restricted to the authorized email clientby determining that a content-type resource rule specifies that aparticular keyword appears in at least one of a body or an attachment ofthe email message.
 20. The access control server of claim 15, whereinthe program determines that access to the email message should berestricted to the authorized email client by determining that a propertyof a sender of the email message is associated with a particular domain,a particular username, or a particular email address.